We keep this list short deliberately. Each subprocessor is bound by data-protection terms, engaged only for the purpose listed, and reviewed before addition. Your workspace records are stored by Supabase in ap-southeast-1 (Singapore); the web tier runs on Vercel in sin1 (Singapore).
Last reviewed: 2026-09-24. This list is reviewed on every vendor change and at least quarterly.
| Vendor | Purpose | Data categories | Region | Documentation |
|---|---|---|---|---|
| Supabase | Database, authentication and file storage: the primary store for workspace data | Workspace content; Account data; Uploaded files; Backups | ap-southeast-1 | supabase.com/privacy |
| Vercel | Application hosting, serverless execution, CDN and edge network | Request metadata; Application and diagnostic logs | sin1 | vercel.com/legal |
| Stripe | Payment processing, billing and payouts | Billing contact details; Subscription and payment status; Card data (held by Stripe, never stored by WorkBOS) | unspecified | stripe.com/privacy |
| Resend | Transactional email delivery | Email address; Message content | unspecified | resend.com/legal |
| OpenAI | AI feature processing for operations you invoke, when the model router selects it; the voice of Chief’s live conversation (it hears what you say to Chief and speaks Chief’s answers) | Workspace content sent for a requested AI operation; Audio of a live voice conversation with Chief, and the text of Chief’s spoken answers, processed in real time and not kept by WorkBOS | unspecified | openai.com/policies/privacy-policy |
| Anthropic | AI feature processing for operations you invoke, when the model router selects it | Workspace content sent for a requested AI operation | unspecified | anthropic.com/legal/privacy |
| Groq | AI feature processing for operations you invoke, when the model router selects it; turning a spoken request to Chief into text in browsers that cannot do it themselves (Firefox) | Workspace content sent for a requested AI operation; Audio of a spoken request to Chief (Firefox only), transcribed and not kept | unspecified | groq.com/privacy-policy/ |
| Cloudmersive | Antivirus scanning of uploaded files | File contents at scan time | unspecified | cloudmersive.com/privacy-policy |
“unspecified” means exactly that: the vendor operates in multiple regions and we have not pinned it to one, so we will not state a region we have not verified. Ask us and we will send the vendor’s current regional documentation.
How you are notified when this list changes
Material changes are announced in-product and reflected here with a new review date. If you have executed our Data Processing Addendum, we notify you before a new subprocessor starts processing your data and you have the right to object, as set out in that document. To be added to the notification list, email privacy@workbos.com from your workspace owner account and ask for subprocessor change notices.
Bring-your-own AI
If you configure your own model endpoint (BYO-LLM), that provider processes AI requests under YOUR agreement with them and is not our subprocessor.
Questions
privacy@workbos.com